fix: remove custom block response from WAF rules (CF free plan)

Cloudflare Free plan doesn't support custom response body in block
rules. Use plain block action which returns CF's default 403 page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/cloudflare/waf.go

@@ -253,20 +253,14 @@ func IsAppRule(desc string) (string, bool) {
 	return "", false
 }
 
-// newBlockRule creates a rule struct with the standard felhom block response.
+// newBlockRule creates a rule struct with a block action.
+// Custom response body requires a paid CF plan, so we use a plain block (403).
 func newBlockRule(description, expression string) rule {
 	enabled := true
 	return rule{
 		Description: description,
 		Expression:  expression,
 		Action:      "block",
-		ActionParameters: &actionParameters{
-			Response: &blockResponse{
-				StatusCode:  403,
-				Content:     "Hozzáférés megtagadva — az Ön országa nem engedélyezett.",
-				ContentType: "text/plain",
-			},
-		},
-		Enabled: &enabled,
+		Enabled:     &enabled,
 	}
 }